An intellectually honest review.
Made of building blocks you can understand, trust and build on.
Facts you can check.
Judgement you can question.
Agentic exploration rediscovers your codebase on every run, answering it differently. Abstraction compiles it once, keeps it current, and hands the facts to an LLM.
Computed
From the semantic model of your codebase. The same answer on every run.
- Which functions a pull request changes, what was only renamed, and which code is generated.
- Who calls each changed function, what it calls, and who else reads or writes the state it touches.
- Your deterministic checks, on every statically traceable path, in milliseconds.
Reasoned
By an LLM, with those facts in hand.
- What each changed function now does, and whether that is a bug.
- Whether a finding holds up. A separate step drops false positives before anything is posted.
- The judgement calls no query can make, like your team’s conventions.
%20scale(0.005371%20-0.005371)'%3e%3cpath%20d='M150%200L150%201490L417%201490L417%20874L1110%20874L1110%201490L1377%201490L1377%200L1110%200L1110%20649L417%20649L417%200Z%20M1944.04%201490L1944.04%200L1677.04%200L1677.04%201490Z%20M2886.6%20-20Q2680.6%20-20%202525.6%2073Q2370.6%20166%202283.6%20337Q2196.6%20508%202196.6%20743Q2196.6%20984%202286.1%201155.5Q2375.6%201327%202529.6%201418.5Q2683.6%201510%202878.6%201510Q3001.6%201510%203108.1%201474Q3214.6%201438%203298.1%201371.5Q3381.6%201305%203435.1%201214Q3488.6%201123%203505.6%201014L3232.6%201014Q3214.6%201074%203183.1%201121Q3151.6%201168%203107.1%201202Q3062.6%201236%203006.1%201253.5Q2949.6%201271%202881.6%201271Q2761.6%201271%202667.1%201210Q2572.6%201149%202518.6%201032Q2464.6%20915%202464.6%20745Q2464.6%20577%202518.6%20459.5Q2572.6%20342%202667.6%20280.5Q2762.6%20219%202887.6%20219Q3001.6%20219%203085.1%20263Q3168.6%20307%203214.1%20388Q3259.6%20469%203259.6%20579L3320.6%20569L2915.6%20569L2915.6%20779L3518.6%20779L3518.6%20600Q3518.6%20409%203437.1%20269.5Q3355.6%20130%203213.1%2055Q3070.6%20-20%202886.6%20-20Z%20M3777.72%200L3777.72%201490L4044.72%201490L4044.72%20874L4737.72%20874L4737.72%201490L5004.72%201490L5004.72%200L4737.72%200L4737.72%20649L4044.72%20649L4044.72%200Z'%20fill='%23ffffff'/%3e%3c/g%3e%3c/svg%3e)
Exports under-bill mid-cycle upgradesExportCSV in invoices/export.go calls ProrateSeats and casts Seats to an int, so a 2.5-seat upgrade exports as 2 and the export stops matching the invoice.
▶ Fix in…One comment from the pull request above.
The reach is computed. ExportCSV lives in another package, and no line of the diff touches it. The semantic model finds every caller of ProrateSeats and shows the reviewer how they use it.
The consequence is reasoned. Reading that call, the reviewer works out what a fractional seat count does to the export.
Discuss opens the finding in a chat with our agent. Fix in opens Claude Code, Codex or Cursor on your repository with the finding as a ready-made prompt.
Name what matters.
Tags and roles are a structure you can curate yourself enabling a shared vocabulary and fast lookups.
This function writes customer data to a bucket outside the system. Tag what the code touches, and add your own tags for what your team cares about.
Once named, it can be found in one query and followed through every flow. The tag travels with the value until a sanitizer clears it, and that is what checks are written against.
Make your intent a hard constraint.
Your rules, enforced on every pull request.
The rule
Asked of our agent as "personal data never reaches a log line". It drafted the query from the codebase, and an admin approved it. Read aloud: the places personal data ends up share nothing with what loggers take in.
The counter-example
assertNoOverlap: 1 shared element
- api/invites.ts email Email
- → mail/queue.ts job.payload
- → log/logger.ts info(job) Logger
The invite handler's email flows into the queued job, and the queue hands every job to the logger. No line of the diff mentions a logger. The shared element is the value trail that breaks the rule.
No name, email or phone number reaches a log call, on any path.
Every value tagged sensitive passes a sanitizer before any database write. An agent then reads the functions this change reaches for consent handling.
Every function tagged public passes an authentication check before it handles the request, on every path.
When a prompt or Markdown file is added or changed, an agent checks it against the team’s conventions.
Nothing tagged annual reaches ProrateSeats, directly or through its callers.
AQL (Abstraction Query Language) checks are deterministic queries over the semantic model: data flow, reach and structure, on every path that can be traced statically, in milliseconds. Agent checks take the rest: code that is not statically traceable, and judgement calls like conventions and style.
A review comment that keeps coming back becomes a check. Nobody writes it twice.
01 · WriteAsk our agent in a sentence and the check runs on every repository in the workspace, or commit a check file to cover just that repository, like any CI check. Templates cover GDPR, entrypoints and more.
02 · ScopeScope it to the paths, file types, tags or roles it cares about, so it runs only where they change.
03 · EvaluateIt queries the semantic model, not the text, so it catches what code reaches, not just what it mentions.
04 · GateEach check is its own GitHub check run. Set its severity to fail, and branch protection makes it a merge requirement.
CI proves the code builds. Checks hold it to your rules, whoever wrote it. Each check you add guards every pull request after it, so trust in the review compounds.
Review your next pull request with Abstraction.
We are onboarding teams in waves. Request access and we will reach out when your spot opens.
ABSTRACTION
2026
Abstr AB · Karlavägen 50, Stockholm